# Logstash Jdbc connection error **URL:** \ **Category:** Logstash\ **Tags:** jdbc\ **Created:** [March 28, 2024, 7:08am UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-error/356358 "2024-03-28T07:08:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![viera120](https://avatars.discourse-cdn.com/v4/letter/v/74df32/32.png) [@viera120](https://discuss.elastic.co/u/viera120)\ **Post date:** [March 28, 2024, 7:08am UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-error/356358/1 "2024-03-28T07:08:11Z")
Hi, We are running a 3 node elastic cluster to index logs from a firewall. Filebeat and Redis Queue are used to forward the logs to Logstash for necessary parsing, after which it is indexed in to the Elastic cluster. Data regarding the ip address and Endusers is maintained in a local mysql database on the Logstash machine for enrichment of firewall logs. Logstash jdbc static filter plugin is used to ingest data from the mysql database to Logstash and further the user detail enrichment of the firewall logs is being done. The jdbc static filter configuration part in the Logstash configuration file used for enrichment is as follows. ```auto jdbc_static { loaders =>[ { id => "user-details" query => "SELECT user-name, ip_address FROM eusers" local_table => "edata" } ] local_db_objects => [ { name => "edata" index_columns => ["ip_address"] columns =>[ ["name","varchar(100)"] ["ip_address","varchar(15)"] ] } ] local_lookups => [ { id => "local-edata" query => "SELECT name from edata where ip_address = ?" prepared_parameters => ["[srcip]"] target => "user" } ] add_field => { user_name => "%{[user][0][name]}"} remove_field => ["user"] staging_directory => "/tmp/logstash/jdbc_static/import_data" loader_schedule => "*/2 * * * *" # run loaders every half hours jdbc_user => "end-users" jdbc_password => " **********" jdbc_driver_class => "com.mysql.cj.jdbc.Driver" jdbc_driver_library => "/usr/share/logstash/logstash-core/lib/jars/mysql-connector-j-8.0.32.jar" jdbc_connection_string => "jdbc:mysql://127.0.0.1:3306/enduserdb" ``` However, for past few days the end user enrichment has stopped working and while logstash service is started the following error is thrown. ```auto 2024-03-28T10:12:17,089][ERROR][logstash.javapipeline][main] Pipeline error {:pipeline_id=>"main", :exception=>#, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/sequel-5.75.0/lib/sequel/adapters/jdbc.rb:66:in `load_driver'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-jdbc-5.4.8/lib/logstash/filters/jdbc/basic_database.rb:98:in `verify_connection'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-jdbc-5.4.8/lib/logstash/filters/jdbc/read_write_database.rb:58:in `post_create'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-jdbc-5.4.8/lib/logstash/filters/jdbc/basic_database.rb:33:in `create'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-jdbc-5.4.8/lib/logstash/filters/jdbc/lookup_processor.rb:36:in `initialize'", "org/jruby/RubyClass.java:917:in `new'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-jdbc-5.4.8/lib/logstash/filters/jdbc_static.rb:207:in `prepare_runner'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-jdbc-5.4.8/lib/logstash/filters/jdbc_static.rb:158:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:237:in `block in register_plugins'", "org/jruby/RubyArray.java:1989:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:236:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:611:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:249:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:194:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:146:in `block in start'"], "pipeline.sources"=>["/etc/logstash/conf.d/fortigate.conf"], :thread=>"#"} [2024-03-28T10:12:17,091][INFO][logstash.javapipeline][main] Pipeline terminated {"pipeline.id"=>"main"} [2024-03-28T10:12:17,099][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create
, action_result: false", :backtrace=>nil} [2024-03-28T10:12:17,109][INFO][logstash.runner] Logstash shut down. [2024-03-28T10:12:17,116][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:808) ~[jruby.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:767) ~[jruby.jar:?] at usr.share.logstash.lib.bootstrap.environment.
(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?] ``` We have tried replacing the jar file with the latest available jar file from the mysql website. Please let us know how this can be solved? Thank you. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 28, 2024, 7:44am UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-error/356358/2 "2024-03-28T07:44:14Z")
I'm not sure if it's related to the MySQL part because the first line of what you shared shows: ```auto ConnectionJdbcException: org.apache.derby.jdbc.EmbeddedDriver not loaded ``` Which is related to me to the internal database used for local lookups. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 28, 2024, 4:52pm UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-error/356358/3 "2024-03-28T16:52:00Z")
> [@viera120](#): > > `[logstash.javapipeline][main] Pipeline error {:pipeline_id=>"main", :exception=>#` That looks a lot like [this issue](https://github.com/logstash-plugins/logstash-integration-jdbc/issues/159). The fix was committed a couple of days ago, so it is probably not in any release. Downgrade to 8.12.1? ---
**Author:** ![viera120](https://avatars.discourse-cdn.com/v4/letter/v/74df32/32.png) [@viera120](https://discuss.elastic.co/u/viera120)\ **Post date:** [March 30, 2024, 9:35am UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-error/356358/4 "2024-03-30T09:35:52Z")
Hi, Thanks for your response. The error has been resolved after upgrade of elastic and logstash to latest version i.e 8.13. ---
**Author:** ![viera120](https://avatars.discourse-cdn.com/v4/letter/v/74df32/32.png) [@viera120](https://discuss.elastic.co/u/viera120)\ **Post date:** [March 30, 2024, 9:36am UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-error/356358/5 "2024-03-30T09:36:52Z")
Hi, Thank you for your response. The error has been resolved after upgrade of elastic and logstash to latest version i.e 8.13. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 27, 2024, 9:37am UTC](https://discuss.elastic.co/t/logstash-jdbc-connection-error/356358/6 "2024-04-27T09:37:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.